{"record":{"id":"3cc24958ddf0b856","repo":"puppetlabs/puppet","slug":"could-not-read-ftype-resource-title-detai","errorCode":null,"errorMessage":"Could not read #{ftype} #{resource.title}: #{detail}","messagePattern":"Could not read #(.+?) #(.+?): #(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/file/data_sync.rb","lineNumber":91,"sourceCode":"        end\n        DateTime.parse(current) >= DateTime.parse(desired)\n      rescue => detail\n        self.fail Puppet::Error, \"Resource with checksum_type #{checksum_type} didn't contain a date in #{current} or #{desired}\", detail.backtrace\n      end\n    end\n\n    def retrieve_checksum(resource)\n      stat = resource.stat\n      return :absent unless stat\n\n      ftype = stat.ftype\n      # Don't even try to manage the content on directories or links\n      return nil if %w[directory link fifo socket].include?(ftype)\n\n      begin\n        resource.parameter(:checksum).sum_file(resource[:path])\n      rescue => detail\n        raise Puppet::Error, \"Could not read #{ftype} #{resource.title}: #{detail}\", detail.backtrace\n      end\n    end\n\n    def contents_sync(param)\n      return_event = param.resource.stat ? :file_changed : :file_created\n      resource.write(param)\n      return_event\n    end\n  end\nend\n","sourceCodeStart":73,"sourceCodeEnd":102,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/file/data_sync.rb#L73-L102","documentation":"During file content sync, data_sync#retrieve_checksum calls the checksum property's sum_file on the current on-disk file; any exception is wrapped as Puppet::Error 'Could not read <ftype> <title>: <detail>'. Directories, links, fifos, and sockets are skipped, and a missing stat yields :absent — the raise comes from actually reading the file.","triggerScenarios":"A file resource managing content on a file the agent user cannot read (mode 0600 owned by another user, agent running non-root); SELinux denying read; the path vanishing between stat and sum_file (race with another tool); unusual file types on the platform.","commonSituations":"Running puppet as a non-privileged user over root-owned files; SELinux contexts on RHEL; ACL-restricted files; deployment tools and Puppet racing on the same path.","solutions":["Check readability as the agent user: `sudo -u puppet head -c1 /path` and inspect ls -l / getfacl.","Fix ownership or manage owner/mode on the resource so the agent can read it.","Check SELinux: `ausearch -m avc -ts recent`, then restorecon the path.","If it is a race, run the agent when other deployment tooling is quiet."],"exampleFix":"# before: agent runs non-root against a 0600 root-owned file\n# -> Could not read file /etc/secrets/app.key: Permission denied\n\n# after: run the agent as root and converge permissions explicitly\nfile { '/etc/secrets/app.key':\n  ensure => file,\n  owner  => 'root',\n  group  => 'app',\n  mode   => '0640',\n  source => 'puppet:///modules/app/app.key',\n}","handlingStrategy":"validation","validationCode":"# Ruby pre-flight before managing content\nbegin\n  st = File.lstat(path)\n  unless %w[directory link fifo socket].include?(st.ftype)\n    fail(\"#{path} not readable by uid #{Process.uid}\") unless File.readable?(path)\n  end\nrescue Errno::ENOENT\n  # absent is fine — content will simply be created\nend","typeGuard":null,"tryCatchPattern":"rescue Puppet::Error => e; the message starts with 'Could not read' and embeds the original cause — log it, check ACLs/SELinux for that exact path, fix readability, then re-run; the agent is idempotent and will converge on the second pass.","preventionTips":["Run the agent as a user that can read managed files (usually root).","Manage owner/mode on sensitive files in the same catalog.","Check SELinux audit logs when /var paths are involved.","Avoid two deploy tools racing on one path."],"tags":["puppet","file","content-sync","permissions","selinux"],"backgroundTag":"file-read-failure","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}